Examkin

Soru

Zorluk: KolayConfigure Storage Encryption and Customer-Managed Keys

Contoso Corp has an Azure subscription containing a Key Vault named contosokey1 and a Storage Account named contosodata1. You plan to configure contosodata1 to use customer-managed keys (CMK) stored in contosokey1 to encrypt storage data.

Which two features must be enabled on contosokey1 before you can configure CMK encryption? (Select two.)

  1. Soft deleteCevap
  2. Purge protectionCevap
  3. C
    The Key Vault Contributor role for the storage account managed identity
  4. D
    The trusted Microsoft services firewall bypass setting

Cevap

Soft delete and Purge protection must be enabled on the Key Vault.
To use customer-managed keys for storage encryption, the Key Vault must have both soft delete and purge protection enabled. Soft delete ensures that deleted vaults or keys can be recovered within a retention period, while purge protection prevents the permanent deletion of the key or vault until the retention period has elapsed.

Adım Adım Çözüm

1
Identify key vault prerequisites for customer-managed key (CMK) encryption.
To protect against accidental key deletion, Azure Storage requires both soft delete and purge protection to be enabled on the target Key Vault.
If a key used for encryption is permanently deleted, all data in the storage account becomes unreadable. Soft delete and purge protection provide a safety window to recover the key.
2
Evaluate key vault role permissions.
The storage account requires data-plane permissions to wrap and unwrap keys (such as Key Vault Crypto Service Encryption User), not control-plane permissions like Key Vault Contributor.
Azure RBAC distinguishes between control-plane actions (managing the key vault resource) and data-plane actions (performing cryptographic operations on the keys).

Anahtar Kavram

Key Vault requirements for Storage Account Customer-Managed Keys (CMK)
Bu soruyu puanla

Konular

Configure Storage Encryption and Customer-Managed Keys

Bu konudan daha fazla soru